CVE-2026-86318

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86318

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86318.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86318

Published

2026-09-07T14:30:14Z

Modified

2026-09-10T03:30:21Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

java-json-tools json-patch JsonMergePatchDeserializer.java JsonMergePatch.fromJson stack-based overflow

Details

A flaw has been found in java-json-tools json-patch up to 1.13. Affected is the function JsonMergePatch.fromJson of the file JsonMergePatchDeserializer.java. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-121"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86318.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0"
                },
                {
                    "last_affected": "1.0"
                },
                {
                    "introduced": "1.1"
                },
                {
                    "last_affected": "1.1"
                },
                {
                    "introduced": "1.10"
                },
                {
                    "last_affected": "1.10"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/java-json-tools/json-patch

Affected ranges

Type

GIT

Repo

https://github.com/java-json-tools/json-patch

Events

Introduced

5922bdcee44d9e58335cdbdbcc35b3bcfe43d38a

Last Affected

7c391b5d3c6b1649178c7278c1096b65e974e4ae

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.2"
        },
        {
            "last_affected": "1.2"
        },
        {
            "introduced": "1.3"
        },
        {
            "last_affected": "1.3"
        },
        {
            "introduced": "1.4"
        },
        {
            "last_affected": "1.4"
        },
        {
            "introduced": "1.5"
        },
        {
            "last_affected": "1.5"
        },
        {
            "introduced": "1.6"
        },
        {
            "last_affected": "1.6"
        },
        {
            "introduced": "1.7"
        },
        {
            "last_affected": "1.7"
        },
        {
            "introduced": "1.8"
        },
        {
            "last_affected": "1.8"
        },
        {
            "introduced": "1.9"
        },
        {
            "last_affected": "1.9"
        },
        {
            "introduced": "1.11"
        },
        {
            "last_affected": "1.11"
        },
        {
            "introduced": "1.12"
        },
        {
            "last_affected": "1.12"
        },
        {
            "introduced": "1.13"
        },
        {
            "last_affected": "1.13"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.11

1.12

1.13

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

v1.*

v1.11

v1.13

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86318.json"